Digital Forensics Questions, Answered

Every item is logged on receipt with its make, model, serial or identifier, physical condition and the name of the person who handed it over. We image the device rather than working on the original, verify the image with a cryptographic hash, and conduct the analysis on the verified copy. The original is sealed and stored. Every transfer between people or storage states is signed and timestamped. See the digital forensics laboratory page for how the workflow runs end to end.

With a written, unbroken record of every person who held the evidence and every action taken on it, from intake to return. Chain of custody is not a form we fill in at the end. It is a running log, and the log is part of the report. When an examiner cannot say who had the device on a given Tuesday, opposing counsel does not need to attack the analysis at all. See Daubert challenges and admissibility.

Yes. Forensic images and case files are held on encrypted storage, and working copies are encrypted at rest. Access is limited to the examiner assigned to the matter and, where a case requires review, to the founder. We do not place client evidence on consumer cloud services, and we do not transmit case material over unencrypted channels. If your matter carries a specific handling requirement, tell us at intake and we will confirm in writing whether we can meet it. See digital security.

Original media is stored sealed and offline. Forensic images and reports are retained for the duration of the matter and for a defined retention period after it closes, so that a case which reopens on appeal does not find the evidence gone. You can instruct us in writing to extend that period, to return your material, or to destroy our copies once the matter is final. Full terms are on our policies page.

Yes. We do not discuss the existence of an engagement, the identity of a client, or any finding with anyone outside the matter, including after the matter ends. The exceptions are narrow and we name them rather than hiding them: a court order, a subpoena we cannot lawfully resist, or your own written authorisation. When a case is attorney-retained, the confidentiality obligation runs to counsel. See our code of ethics and business conduct.

No, when the examination is done correctly. We acquire a forensic image through a write blocker or a validated acquisition method, which means the analysis happens on a copy while your original stays untouched. The hash value proves the copy matches the original and that nothing changed during the process. In our experience the real risk to a device is not the examination. It is the two weeks before it, when someone keeps using the phone. See digital forensic services.

Our reports are prepared to the standards courts apply to digital evidence, which means documented methodology, verified acquisition, an unbroken chain of custody and findings stated no further than the evidence supports. Admissibility is decided by the court, not by the examiner, and any firm that promises otherwise is telling you something it cannot control. What we control is the record. We build the report so that the method survives examination. See legal consultancy services.

Wanderson Castilho is Cellebrite certified, AccessData certified and a Certified Computer Examiner (CCE) (Source: SEAK Expert Witness Directory, 2026). He holds a BSc in Physics from the Federal University of Paraná, is a member of the Association of Certified Fraud Examiners, and served on the electronic law commission of the São Paulo bar association. He has 21 years in practice and has published four books on cybercrime and digital investigation. See Wanderson Castilho.

Yes. Castilho has testified as a digital forensics expert witness and has been retained by counsel on both sides of matters, which is the relevant point. An examiner who has only ever testified for one side has a pattern that opposing counsel will put in front of the jury. Testimony is a separate discipline from examination, and we treat it that way. See deposition and trial testimony.

Forty depositions in the past four years (Source: SEAK Expert Witness Directory, 2026). That volume is the single most useful thing an attorney can know before retaining an examiner, because deposition experience is what separates a competent analyst from a witness who holds up under cross-examination. Forty sittings in four years means the questions are familiar, the exhibits are organised for them, and the answers do not drift. Read the founder’s full record or the page on deposition and trial testimony.

Yes, and it is a substantial part of our litigation work. We re-acquire or re-examine the underlying evidence where it is available, reproduce the other examiner’s stated method, and document where the method, the data or the conclusion does not hold. The most common failures we see are not arithmetic. They are conclusions stated well past what the artifacts support, and gaps in the custody record. See rebuttal and report review.